CVE-2025-0743

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.

• CWE-284

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedaiThird Party Advisory

Published

Jan 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0734A vulnerability has been found in y_project RuoYi up to 4.8.…7.2
• CVE-2025-0736A flaw was found in Infinispan, when using JGroups with JDBC…5.5
• CVE-2025-0739An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0740An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0741An Improper Access Control vulnerability has been found in E…4.3
• CVE-2025-0742An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0744an Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0745An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0746A Reflected Cross-Site Scripting vulnerability has been foun…5.4
• CVE-2025-0747A Stored Cross-Site Scripting vulnerability has been found i…5.4
• CVE-2025-0748The Homey theme for WordPress is vulnerable to Cross-Site Re…4.3
• CVE-2025-0749The Homey theme for WordPress is vulnerable to authenticatio…8.1